Redirect to a static badge instead of returning status code 500

core/base-service/redirector.js

@@ -4,6 +4,7 @@ const camelcase = require('camelcase')
 const emojic = require('emojic')
 const Joi = require('@hapi/joi')
 const queryString = require('query-string')
+const log = require('../server/log')
 const BaseService = require('./base')
 const {
   serverHasBeenUpSinceResourceCached,
@@ -116,9 +117,14 @@ module.exports = function redirector(attrs) {
         }${targetPath}.${format}${urlSuffix}`
         trace.logTrace('outbound', emojic.shield, 'Redirect URL', redirectUrl)
 
-        ask.res.statusCode = 301
-        ask.res.setHeader('Location', redirectUrl)
-
+        try {
+          ask.res.statusCode = 301
+          ask.res.setHeader('Location', redirectUrl)
+        } catch (e) {
+          log.error(new Error(`An invalid URL in '${this.name}' redirector.`))
+          ask.res.statusCode = 302
+          ask.res.setHeader('Location', '/badge/badge-inaccessible-lightgray')
+        }
         // To avoid caching mistakes for a long time, and to make this simpler
         // to reason about, use the same cache semantics as the static badge.
         setCacheHeadersForStaticResource(ask.res)

core/base-service/redirector.spec.js

@@ -93,6 +93,19 @@ describe('Redirector', function() {
       expect(headers.location).to.equal('/new/service/hello-world.svg')
     })
 
+    // https://github.com/badges/shields/issues/4013
+    it('should temporarily redirect to a badge with message "inaccesible" when redirect URL is invalid (contains invalid characters)', async function() {
+      const { statusCode, headers } = await got(
+        `${baseUrl}/very/old/service/hello\nworld.svg`,
+        {
+          followRedirect: false,
+        }
+      )
+
+      expect(statusCode).to.equal(302)
+      expect(headers.location).to.equal('/badge/badge-inaccessible-lightgray')
+    })
+
     it('should redirect raster extensions to the canonical path as configured', async function() {
       const { statusCode, headers } = await got(
         `${baseUrl}/very/old/service/hello-world.png`,